Skip to main content

GitPython CVE-2026-73621

| EUVDEUVD-2026-57825 MEDIUM
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2026-08-13 VulnCheck GHSA-h75v-4jxv-ppxm
Code Injection Gitpython Red Hat Suse
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.2 MEDIUM

AC:H reflects the required application-level condition of forwarding user options to count(); PR:L because application access is needed; no confidentiality impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 12:55 vuln.today
Analysis Generated
Aug 13, 2026 - 12:55 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
MEDIUM 5.3

DescriptionCVE.org

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).

AnalysisAI

Arbitrary file truncation in GitPython before 3.1.56 enables an attacker who can control keyword arguments forwarded to Commit.count() to blank any file accessible at the process's privilege level by injecting output=<path>, which causes git rev-list to open and truncate the target to zero bytes before revision parsing. The unguarded sink at commit.py:290-291 is a distinct, overlooked parallel to the sibling iter_items method, which carries the check_unsafe_options guard; this gap persisted after GHSA-956x-8gvw-wg5v addressed iter_commits and blame. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker submits output=<victim_path> via application interface
Delivery
Application forwards user options dict to commit.count(**user_options) without sanitization
Exploit
Unsanitized output= argument reaches git rev-list subprocess via commit.py:290-291
Execution
git rev-list opens and truncates target file to 0 bytes
Persist
Target file destroyed at process privilege level
Impact
Service disruption or configuration corruption
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerable application must explicitly forward a user-controlled keyword arguments dictionary to Commit.count() - specifically, the attacker must be able to supply the output= key in that dict. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium), reflecting network reachability and low complexity once an application routes user input into Commit.count(), but constrained by the PR:L requirement and limited VI:L/VA:L impact (no content control, no confidentiality loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A CI/CD dashboard or code-review application that accepts user-specified rev-list options and forwards them to Commit.count() - for instance, to support custom commit filtering - would allow an authenticated user to submit output=/etc/app/config.ini as an option. The underlying git rev-list subprocess would truncate that file to zero bytes, corrupting application configuration or destroying key material without the attacker ever needing write access to the filesystem directly. …
Remediation Upgrade GitPython to version 3.1.56, which applies the check_unsafe_options guard to Commit.count() in parity with the protection already present in iter_items; this is the only confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2024-39930 CRITICAL POC
9.9

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-73621 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy